Re: [gentoo-dev] Re: [experiment] Sunrise try 2

2006-06-29 Thread Mike Frysinger
On Thursday 29 June 2006 03:16, Stefan Schweizer wrote:
> Do you have anything else I can do?

everything i have seems to be covered
-mike


pgpeMUhKcwDJp.pgp
Description: PGP signature


Re: [gentoo-dev] Re: [experiment] Sunrise try 2

2006-06-29 Thread Mike Frysinger
On Thursday 29 June 2006 01:39, David Shakaryan wrote:
> Mike Frysinger wrote:
> > On Saturday 24 June 2006 18:54, Edward Catmur wrote:
> >> * Security (from malicious contributors): Glad to see layman will only
> >> track the reviewed/ tree; still, anyone who checks out the sunrise/ tree
> >> (and has it in PORTDIR_OVERLAY) is vulnerable.
> >>
> >> - Remove from the examples any suggestion that one should check out the
> >> whole tree when contributing. Point out that one should not svn up
> >> sunrise/ as part of updating Portage.
> >
> > valid point i think
>
> The guide has been edited to inform users that they should *not* use the
> sunrise/ tree for any reason other than committing. Now, in the
> HowToCommit guide, near the instructions for checking out the sunrise/
> tree, it clearly states that you should not set it as your
> PORTDIR_OVERLAY, but use the reviewed/ instead.

you can add documents all you want telling people to not do something ... if 
they are allowed to do it though, they will
-mike


pgpGy7xNFHuZf.pgp
Description: PGP signature


Re: [gentoo-dev] Re: [experiment] Sunrise try 2

2006-06-29 Thread Luca Barbato
Stefan Schweizer wrote:
> I have made a small svncommit.sh script to make committing easier. But it is
> probably not complete yet:
> http://gentoo-sunrise.org/svn/reviewed/scripts/svncommit.sh
> 
> Need to work on that more with feedback from contributors.
> Do you have anything else I can do?

Add support for QA checkers clientside and serverside (there are
precommit hooks you can use for that)

That way we will avoid those smart problems as described in irc long ago.

lu

-- 

Luca Barbato

Gentoo/linux Gentoo/PPC
http://dev.gentoo.org/~lu_zero

-- 
gentoo-dev@gentoo.org mailing list



[gentoo-dev] Re: [experiment] Sunrise try 2

2006-06-29 Thread Stefan Schweizer
Mike Frysinger wrote:
> after looking at some acl stuff i'm 99% sure this can be done ... so can
> we get this setup ?
> 
> in fact, gentoo-wiki.com has a section on doing apache2/svn/dav/acls
> -mike

anonymous checkout is already disabled for some time now:

svn co http://gentoo-sunrise.org/svn/sunrise does not work whereas

svn co http://gentoo-sunrise.org/svn/reviewed works.

I do not know how jokey technically did it, but it was apparently easy :)

The website listing the content of the overlay and referring to the bugs and
herds probably has to wait after jokey's exams which will be next week.

I have made a small svncommit.sh script to make committing easier. But it is
probably not complete yet:
http://gentoo-sunrise.org/svn/reviewed/scripts/svncommit.sh

Need to work on that more with feedback from contributors.
Do you have anything else I can do?

Best regards,
Stefan

-- 
gentoo-dev@gentoo.org mailing list



[gentoo-dev] Re: [experiment] Sunrise try 2

2006-06-28 Thread David Shakaryan
Mike Frysinger wrote:
> On Saturday 24 June 2006 18:54, Edward Catmur wrote:
>> * Security (from malicious contributors): Glad to see layman will only
>> track the reviewed/ tree; still, anyone who checks out the sunrise/ tree
>> (and has it in PORTDIR_OVERLAY) is vulnerable.
>>
>> - Remove from the examples any suggestion that one should check out the
>> whole tree when contributing. Point out that one should not svn up
>> sunrise/ as part of updating Portage.
> 
> valid point i think

The guide has been edited to inform users that they should *not* use the
sunrise/ tree for any reason other than committing. Now, in the
HowToCommit guide, near the instructions for checking out the sunrise/
tree, it clearly states that you should not set it as your
PORTDIR_OVERLAY, but use the reviewed/ instead.

> 
> ive never admined svn repos before, but would it be possible to shut off anon 
> access to the non-reviewed tree ?  i think that would cover this issue as 
> people who get bit by bugs in the non-reviewed tree would (and should) be 
> able to just go in and fix it themselves :)

As far as I understand, not allowing anonymous users to check out the
sunrise/ directory *is* going to be implemented in the future, but you
should get a second word from genstef or jokey on that as I'm not
completely sure.

-- 
David Shakaryan
GnuPG Public Key: 0x4B8FE14B



signature.asc
Description: OpenPGP digital signature


[gentoo-dev] Re: [experiment] Sunrise try 2

2006-06-25 Thread Stefan Schweizer
Luca Barbato wrote:

> Edward Catmur wrote:
>> On Sat, 2006-06-24 at 13:05 +0200, Luca Barbato wrote:
>>> (from critics)
>>> - What is wrong with the model (each point 2 lines at least, 4 at most)
>>> - What you'd do as alternative as the criticized point ( 2 lines again)
> 
> Let me reformat a bit
>>
> 
> Critic 1
>> * Simplicity: The FAQ claims that Sunrise is simpler than Bugzilla. It
>> is - for users. Contributing is a lot more involved than with Bugzilla;
>> Sunrise is supposed to be about making contributing easier.
> 
> Reply 1
>> - Admit this in the FAQ. Where possible, write svn wrappers to make the
>> contributing process easier.

I have added something to the answer in question, if it does not go far
enough I would appreciate a better rewording from you :)
"But in contrast to that it requires more knowledge and tools to get
something into sunrise - more work for contributors. Also contributors have
to get their ebuilds reviewed before committing - bugzilla is easier here."

For wrappers: I am working on a svncommit.sh to generate the digest and svn
commit the ebuilds. This is certainly high on the TODO list :)

> Critic 2
>> * Security (from malicious contributors): Glad to see layman will only
>> track the reviewed/ tree; still, anyone who checks out the sunrise/ tree
>> (and has it in PORTDIR_OVERLAY) is vulnerable.
> 
> Reply 2a
>> - Remove from the examples any suggestion that one should check out the
>> whole tree when contributing.

A contributor needs the whole tree, because of the scripts/ and the
profiles/ directory as well as skel.ChangeLog. For 2b I have added an
explicit warning, I think it covers this as well.

> Reply 2b
> - Point out that one should not svn up sunrise/ as part of updating
> Portage.

right, I added the following:
"The copy of the sunrise you will checkout here is '''not reviewed'''.
Handle with extreme care. Do not use this as your PORTDIR_OVERLAY! Keep
using your reviewed layman copy for PORTDIR_OVERLAY."
> 
> Reply 2c
> - sunrise/playground won't let anonymous fetch.
Yeah, this is certainly easy to do and increases safety. I have been bugging
jokey about this already :)

> Critic 3
>> * Conflicts between contributors (technical): Alice adds an ebuild; Bob
>> makes a change; Alice makes another change and discovers it conflicts
>> with Bob's change in the repo. Alice has not used subversion and doesn't
>> know how to resolve conflicts.
> 
> Reply 3a
> - People are supposed to learn svn in order to contribute.
since we use the IRC channel for contributing, I think this is a non-isssue
because devs in the IRC channel know subversion and can help out. Learning
by doing is preferred.

> Reply 3b
> - Tutorials will be provided about conflict resolution
see #3a, I do not want to write too many docs that are not often needed and
easily explained in IRC.

> Critic 4
>> * Conflicts between contributors (social): Alice adds an ebuild; Bob
>> makes a (maybe "obvious") change; Alice thinks the change is incorrect,
>> and, feeling that the ebuild is her property, reverts the change. A
>> revert war erupts. Many casualties.
> 
> Reply 4a
>> - Create a social structure to enable Alice and Bob to communicate and
>> resolve their differences of opinion. Forums? Wiki? IRC? Bugzilla? I
>> would argue there should be One True location for this to occur; not
>> bugzilla (bugspam); not IRC (impermanence).
IRC is certainly a good and direct way of doing this and it has worked in
the past for us, when we already had a similar conflict. Now you say that
IRC is impermanent, where do you see the problem, can you elaborate that a
bit for me, please? We are open here. Currently there is no forced way of
communication - everyone can chose how to communicate himself.

> Reply 4b
> - ban warmongers.
this can always be done, but it is a last resort that is hopefully not
needed. Of course when someone behaves badly action will be taken.

> Critic 5
>> * More to keep track of: With bugzilla you have a single URL, from which
>> you receive threaded email updates. Sunrise adds /two/ svn directories
>> plus whatever is used for discussion.
>> - Create a summary page that links to bugzilla and discussions, and
>> tracks versions and changes, and all other relevant information. Allow
>> (require?) contributors to subscribe to email updates from the summary
>> page.
Yeah, this is also on our TODO list, currently we have a script for that:
scripts/create-stats.sh - it currently lists only bug entries and herds,
devs on CC for packages in the overlay. A more extensive version of that
needs to be put on a web page, right.
For updates:
Every ebuild-committer is required to CC to the bug, important ebuild
updates need to be mentioned on the bug, I think a second
update/notification system would be overkill here and leave out people that
only use bugzilla.

> Ed if you think this doesn't show your ideas please send another using
> this format.
I changed some things back where I wanted to answer Ed directly. 

[gentoo-dev] Re: [experiment] Sunrise try 2

2006-06-25 Thread David Shakaryan
Mike Frysinger  gentoo.org> writes:
> the examples should use $ as the shell prompt, not #

Fixed. Thanks for catching that. :)

-- 
gentoo-dev@gentoo.org mailing list